c004e016bbfd4a78c0071e3f26829bb2a8ee16939372ce531fb8073f13add785

Analysis

max time kernel
47s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 15:04

Target

c004e016bbfd4a78c0071e3f26829bb2a8ee16939372ce531fb8073f13add785.exe
Size

100KB
MD5

f499ef9663aaafa19a05f3c8bcc9751d
SHA1

c5f7f0ff16239daca7d34da0656314104d816bda
SHA256

c004e016bbfd4a78c0071e3f26829bb2a8ee16939372ce531fb8073f13add785
SHA512

eea4ae04e0424a8d970a740b709426425f828b59e11578c157f86610d64bfe057e0876b721234d50da404b4ecb6b3bbad69ed9a4560dd73aaff28c1c707139cb
SSDEEP

1536:kKMOWzmY4Ndg45itaFsR6c6+ZZjy+zGHQh6KXbNculYT4wA:kKMOWzAND589Z2ChtXbDr

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1300 wrote to memory of 1208	1300	c004e016bbfd4a78c0071e3f26829bb2a8ee16939372ce531fb8073f13add785.exe	27
PID 1300 wrote to memory of 1208	1300	c004e016bbfd4a78c0071e3f26829bb2a8ee16939372ce531fb8073f13add785.exe	27
PID 1300 wrote to memory of 1208	1300	c004e016bbfd4a78c0071e3f26829bb2a8ee16939372ce531fb8073f13add785.exe	27

C:\Users\Admin\AppData\Local\Temp\c004e016bbfd4a78c0071e3f26829bb2a8ee16939372ce531fb8073f13add785.exe
"C:\Users\Admin\AppData\Local\Temp\c004e016bbfd4a78c0071e3f26829bb2a8ee16939372ce531fb8073f13add785.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1300
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 356
  2⤵
  PID:1208

memory/1208-55-0x000007FEFB8B1000-0x000007FEFB8B3000-memory.dmp

Filesize
8KB

Download